There are many definitions for a virtual LAN (or VLAN, for short). A
VLAN can be described as a grouping of ports on a switch or a grouping of ports
on different switches. It can also be characterized as a group of related users
in a data network or as a group of users at the same geographic location (which
is the most common). In the simplest terms, a VLAN is a broadcast domain. In a
bridged network, all devices are in the same broadcast domain. One of the
problems of using bridges for LAN segmentation is that they solve bandwidth
problems, but not broadcast problems. Switches, even though they act like
bridges, have some additional features that make them more robust in solving
your networking problems.

The remainder of this chapter focuses on three areas: VLANs, trunking, and
the Virtual Trunk Protocol (VTP). All three of these areas play an integral part
in the setup of VLANs in your network.

Virtual LANs

Virtual LANs (VLANs) give an administrator the ability to break up a switched
Layer 2 network into multiple broadcast domains. The advantage of this approach
is that it can be done using switches that cost less than traditional routers.
However, each broadcast domain is typically considered to be a separate
subnet. To go between subnets, a Layer 3 component, such as a router, is still
required.

VLANs can be based on the port identifier of a switch, on an end
station's MAC address or Layer 3 address, or on directory or application
information. They also can be implemented in many different ways, depending on
the media topology (Ethernet, FDDI, or ATM) that's deployed.

Advantages of VLANs

One of the main reasons that network administrators buy switches is to help
control bandwidth problems by creating multiple collision or bandwidth domains,
but they can also help contain broadcasts by implementing VLANs. However, VLANs
offer a network administrator many more advantages than just these. Here are
some examples:

They allow multiple parallel paths in a switched network for load
balancing, unlike bridges and the Spanning Tree Protocol.

They isolate problems within a small part of the intranet.

They remove the physical boundaries of a network, thus enabling users and
servers to be located anywhere.

They allow for the deployment of applications across different media
topologies, such as Ethernet, FDDI, and ATM.

They increase performance by limiting the scope of broadcast
traffic.

Containment of Broadcasts

Broadcasts are a normal occurrence in LAN-based protocols such as IP, IPX,
and AppleTalk. In many cases, these broadcasts help users to find and use
services. Many applications also use multicasts to disseminate information,
which include LAN-based TV, video conferencing, routing protocols such as OSPF
and Cisco's Enhanced IGRP, and even the bridges' and switches'
Spanning Tree Protocol. Faulty network cards, Spanning Tree Protocol problems,
or an incorrect application or desktop configuration could cause a flood of
broadcasts or multicasts in a network. When switches see broadcasts and
multicasts, they treat them as unknown destinations and flood the frames out all
of their ports. Too many broadcasts, even from a single PC, can seriously slow a
network's performance, if not bring it down completely.

From the users' perspective, the use of broadcasts makes their lives
easier. However, from the network administrator's perspective, broadcasts
use up bandwidth and affect every user's desktop in the switched network.
Some mechanism is needed to reign in the propagation of broadcasts.

Routers were traditionally used to solve broadcast problems in data networks.
Unfortunately, the use of routers on a port-by-port basis is a very expensive
solution for performing this barrier function. When switches were first
developed, they were essentially bridges with many ports. All ports were in the
same broadcast domain, just like a bridge. This is sometimes referred to as a
flat network.

Broadcasts and VLANs

VLANs are created by logically segmenting a network into separate broadcast
domains. When you create VLANs, frames created by a member of one VLAN are
switched only among ports that are designated as belonging to the same virtual
LAN, which results in a more efficient use of bandwidth. In addition, instead of
broadcast traffic propagating throughout the physical infrastructure, such
traffic is restricted to the broadcast domain that represents the VLAN.

The advantage of this approach is that if a machine goes bonkers with
broadcasts, it affects only the other machines in the same VLAN, not
computers in other VLANs. VLANs allow for the extension of a broadcast barrier
from the router. VLANs basically create the traditional illusion that users are
off of different ports of a router, but in reality, the users are part of the
same switched fabric. Because of this, routers are still required to connect the
VLANs together. Each VLAN, as mentioned earlier, is typically a unique subnet;
to go from one subnet to another, a router is required. Therefore, routers still
perform their traditional role of containing broadcasts, but the quantity of
ports is greatly reduced because of the use of switches.

Because of this huge advantage, VLANs should not be employed across an
intranet, but should rather be terminated within an access layer or building
access. In other words, broadcasts that occur in one-building access should not
be propagated across the core or backbone of the network.

VLAN Implementations

Because broadcasts can be generated in all kinds of network operating systems
and applications, you have a lot of flexibility in creating VLANs and assigning
people and computers to them. You can base VLANs on the following items:

The Layer 3 protocols currently being used in the network

The groups, departments, or divisions in a company

The specific security needs of certain resources

The applications being used in the network

End-to-End VLANs

One of the unique properties of VLANs is that they can span multiple switches.
The physical boundaries of where people and resources are located are removed.
In Figure 3.1, a switched network has
three VLANs spread across three switches: Accounting, Information Services,
and Marketing.

Figure
3.1 A physical view of computers and a logical representation of VLANs.

Note that all the servers are located off of one switch. In traditional networks,
resources such as local file servers would usually be located in the same place
as the users. Spreading the resources like this makes their management much
harder and security harder still. Using VLANs, an administrator can create the
illusion that the file server is on the same segment as the users that access
it, even though the file server could be on a completely different floor in
a completely different building. Figure 3.2
gives a detailed view of both a physical and logical representation of this
concept.

End-to-end VLANs have the following characteristics:

Users are grouped into a VLAN based on function, not location.

The user belongs to the same VLAN no matter where she plugs her PC into
the network (this requires Cisco's VMPS, which is discussed later in this
chapter).

End-to-end VLANs are typically used for security reasons or for
application or resource requirements.

Local VLANs

The problem with end-to-end VLANs is that they become extremely difficult to
maintain as the campus network grows and changes. Because of this, most network
administrators of campus environments use local VLANs.

Unlike end-to-end VLANs, local VLANs are very easy to plan and implement.
Local VLANs are based on geographic locations by demarcation at a hierarchical
boundary (core, distribution, access). Therefore, a local VLAN would never span
from an access layer to a core block. Because VLANs are created based on
geographic or physical boundaries, it's not uncommon to see much of the
traffic leaving the broadcast domain to access a resource.

There are two generic rules when dealing with traffic flow: 80/20 and 20/80.
The 80/20 rule assumes that 80% of the traffic stays local to a VLAN and 20%
leaves a VLAN through a Layer 3 device. Local VLANs assume this premise. Note
that with this implementation, VLANs are solely used to solve broadcast
problems.

With the 20/80 rule, 20% of the traffic stays within the VLAN and 80% leaves
it. In this situation, a burden is placed on the Layer 3 device that is used to
interconnect VLANs. Although they do introduce a latency issue because of the
access of resources outside of the VLAN, this can easily be solved with
multilayer switching, which is discussed in Chapter 6, "Multilayer
Switching."

VLAN Assignment

There are two methods that you can use to associate users to VLANs: dynamic
and static. The following two sections compare and contrast the two methods.

Dynamic VLANs

Dynamic VLANs require you to assign a user to a VLAN, and switches
dynamically use this information to configure the port on the switch
automatically. Dynamic VLANs can be based on the following items:

The advantage of using dynamic VLANs is that network technicians don't
have to worry about making any changes on a switch when they move a user from
one location to another, which is advantageous when end-to-end VLANs are
deployed. Cisco currently allows you to use CiscoWorks 2000 to implement dynamic
VLANs based on MAC addresses.

A VLAN Management Policy Server (VMPS) associates MAC addresses to VLANs.
When a user connects to a switch and the switch sees the user's MAC
address, the switch sends the user's MAC address to the VMPS server. The
server responds with the user's VLAN and the switch associates this VLAN
with the user's interface.

Problems with MAC-based dynamic VLANs include PC NICs failing, PCs being
upgraded, and new PCs continually being added to the network. Managing these MAC
addresses soon becomes a headache in a large-scale switched network.

Therefore, most administrators choose to base VLAN membership on directory
information. Out of all these mechanisms for implementing dynamic VLANs, the use
of directory information is the most flexible and the easiest to maintain. The
only time you would have to make changes to the VLAN database is when a user is
hired, fired, or changes departments. Many vendors, including Cisco, are
developing directory-based dynamic VLANs. The remainder of this chapter and book
focus on static VLANs and their configuration.

CAUTION

Dynamic VLANs use a VMPS to assign VLAN information to a switch, which is
then associated with a user's port. This enables users to be located
anywhere in the network and still be assigned to the correct VLAN. Membership is
typically based on a device's MAC address.

Static VLANs

Cisco's initial implementation of VLANs was based on the port that a
user was assigned to. This is sometimes referred to as port-based
membership. Using this initial implementation, you would configure every
port on a switch to reflect the appropriate VLAN for the users. This could
easily be done either via a command-line interface or an SNMP-based product
using a graphical interface. Anytime a user moved his workstation to a different
area, you would have to reconfigure only the port to which the user
attaches.

Static VLANs are normally used in local VLAN implementations, where the
problem of containing broadcasts is more important than placing specific users
in certain VLANs. Use static VLANs when any of the following criteria apply to
your situation:

You have tight control over the moving of users and resources in the
campus

You do not want the hassles of maintaining the large tables required of
dynamic VLANs

You have a management package that easily maintains VLANs in your
campus

CAUTION

Static VLANs are manually configured: You specify which interface belongs to
which VLAN. This configuration is typically used in a more stable or static
environment. Configuring static VLANs is a very simple process.

Creating and Deleting VLANs

Creating VLANs on your switch is a very simple process. There are two methods
for creating VLANs on Cisco IOS switches: from Privilege EXEC mode and
Configuration mode. The old way, shown here, is done from Privilege EXEC
mode:

When you've entered the interface, use the switchport mode
access command to specify that this interface is associated with a single
VLAN. The switchport access vlancommand associates a VLAN to
this particular interface.

NOTE

Depending on the model, there is at least one pre-configured VLAN on your
switch: VLAN 1. By default, all ports are associated with VLAN 1.

CAUTION

Use the switchport mode access command to define an interface as an
access link and the switchport access vlan command to associate an
interface with a VLAN.

Verifying Your Configuration

After you've created your VLANs and placed interfaces in them, you can
use various show commands to verify your VLAN configuration. To view
your configured VLANs, use the show vlan command:

Switch# show vlan [idVLAN_# | nameVLAN_name]

Without any of the optional parameters, all VLANs are listed. You can
optionally specify a VLAN number or name to examine a specific VLAN. Here's
an example of the use of this command:

To see which MAC addresses are associated with which interfaces, as well as
which VLAN the interface is associated with, you can use the show
mac-address-table command, which displays the port address or CAM (content
addressable memory) table:

As you can see in this example, there is one MAC address in the table off of
interface fa0/1, which is associated with VLAN 1.

Troubleshooting VLAN Problems

If you're experiencing connectivity problems in a VLAN environment, you
should perform the following troubleshooting steps:

Do you have a physical and data link layer connection? Check the status
of the interface with the show interfaces command. Use CDP to check
connectivity. Check the duplexing of the connection (auto negotiation is a
common problem with the negotiation of the duplexing mode).

Is your router and switch configuration correct? Verify that you've
configured your routing protocol and your router's interface. If
you're trunking between the router and the switch, verify this
configuration.

Have you set up your VLAN configuration correctly? Check to make sure
that the appropriate interfaces are associated with the correct VLANs.